Direct Upload: Browser to Cloudflare R2

Browser asks Go backend for a presigned URL, then uploads directly to R2.

If upload fails with CORS, allow origin http://localhost:3000 and method PUT in R2 CORS.